I lenei tusiga, ou te manaʻo e faʻasoa atu ia te oe se metotia mo le fatuina o se tusi faamaonia SSL mo lau 'upega tafaʻilagi o loʻo faʻaogaina i luga o Docker, aua ... Ou te leʻi mauaina se vaifofo faapena i le vaega o le Initaneti i le gagana Rusia.
Fa'amatalaga atili i lalo ole tipi.
Sa i ai le matou docker v.17.05, docker-compose v.1.21, Ubuntu Server 18 ma se pint o le Let'sEncrypt mama. E le faapea e tatau ona faʻapipiʻi le gaosiga i luga o Docker. Ae a amata loa ona e fausia Docker, e faigata ona taofi.
O lea la, e amata ai, o le a ou tuʻuina atu tulaga masani - lea na matou i ai i le tulaga dev, i.e. e aunoa ma le taulaga 443 ma le SSL lautele:
faicker-compose.yml
version: '2'
services:
php:
build: ./php-fpm
volumes:
- ./StomUp:/var/www/StomUp
- ./php-fpm/php.ini:/usr/local/etc/php/php.ini
depends_on:
- mysql
container_name: "StomPHP"
web:
image: nginx:latest
ports:
- "80:80"
- "443:443"
volumes:
- ./StomUp:/var/www/StomUp
- ./nginx/main.conf:/etc/nginx/conf.d/default.conf
depends_on:
- php
mysql:
image: mysql:5.7
command: mysqld --sql_mode=""
environment:
MYSQL_ROOT_PASSWORD: xxx
ports:
- "3333:3306"
nginx/main.conf
server {
listen 80;
server_name *.stomup.ru stomup.ru;
root /var/www/StomUp/public;
client_max_body_size 5M;
location / {
# try to serve file directly, fallback to index.php
try_files $uri /index.php$is_args$args;
}
location ~ ^/index.php(/|$) {
#fastcgi_pass unix:/var/run/php7.2-fpm.sock;
fastcgi_pass php:9000;
fastcgi_split_path_info ^(.+.php)(/.*)$;
include fastcgi_params;
fastcgi_param SCRIPT_FILENAME $realpath_root$fastcgi_script_name;
fastcgi_param DOCUMENT_ROOT $realpath_root;
fastcgi_buffer_size 128k;
fastcgi_buffers 4 256k;
fastcgi_busy_buffers_size 256k;
internal;
}
location ~ .php$ {
return 404;
}
error_log /var/log/nginx/project_error.log;
access_log /var/log/nginx/project_access.log;
}
Le isi, matou te manaʻomia moni lava le faʻatinoina o le SSL. Ina ia faʻamaoni, sa ou faʻaaluina pe a ma le 2 itula e suʻesuʻe ai le com zone. O filifiliga uma e ofoina atu iina e manaia. Ae i le tulaga o loʻo i ai nei o le poloketi, matou (le pisinisi) e manaʻomia le faʻavave vave ma faʻalagolago SSL Let'sEnctypt к nginx pusa ma leai se isi mea.
Muamua lava, matou faʻapipiʻiina i luga o le server tusipasi
sudo apt-get install certbot
Ona sosoo ai lea ma le faia o tusi faamaonia mo la matou vaega
sudo certbot certonly -d stomup.ru -d *.stomup.ru --manual --preferred-challenges dns
a maeʻa le faʻatinoga, o le a tuʻuina mai e le certbot ia i matou faʻamaumauga 2 TXT e manaʻomia ona faʻamaonia i totonu o le DNS.
_acme-challenge.stomup.ru TXT {тотКлючКоторыйВамВыдалCertBot}
Ma fetaomi ulufale.
A maeʻa lenei mea, o le a siaki e le certbot le i ai o nei faʻamaumauga i DNS ma fatuina tusi faamaonia mo oe.
afai ua e faaopoopo i ai se tusi faamaonia ae tusipasi le maua - taumafai e toe amata le poloaiga pe a uma le 5-10 minute.
Ia, oi matou nei o tagata faʻamaualuga o le Let'sEncrypt tusipasi mo 90 aso, ae o lea e tatau ona matou lafoina i Docker.
Ina ia faia lenei mea, i le auala sili ona le taua, i le docker-compose.yml, i le vaega nginx, matou te faʻafesoʻotaʻi faʻamaumauga.
Faataitaiga docker-compose.yml ma SSL
version: '2'
services:
php:
build: ./php-fpm
volumes:
- ./StomUp:/var/www/StomUp
- /etc/letsencrypt/live/stomup.ru/:/etc/letsencrypt/live/stomup.ru/
- ./php-fpm/php.ini:/usr/local/etc/php/php.ini
depends_on:
- mysql
container_name: "StomPHP"
web:
image: nginx:latest
ports:
- "80:80"
- "443:443"
volumes:
- ./StomUp:/var/www/StomUp
- /etc/letsencrypt/:/etc/letsencrypt/
- ./nginx/main.conf:/etc/nginx/conf.d/default.conf
depends_on:
- php
mysql:
image: mysql:5.7
command: mysqld --sql_mode=""
environment:
MYSQL_ROOT_PASSWORD: xxx
ports:
- "3333:3306"
Feso'ota'i? Manaia - tatou fa'aauau:
O lea la e tatau ona tatou suia le config nginx e galulue faatasi 443 uafu ma SSL masani:
Faataitaiga main.conf config ma SSL
#
server {
listen 443 ssl http2;
listen [::]:443 ssl http2;
server_name *.stomup.ru stomup.ru;
set $base /var/www/StomUp;
root $base/public;
# SSL
ssl_certificate /etc/letsencrypt/live/stomup.ru/fullchain.pem;
ssl_certificate_key /etc/letsencrypt/live/stomup.ru/privkey.pem;
ssl_trusted_certificate /etc/letsencrypt/live/stomup.ru/chain.pem;
client_max_body_size 5M;
location / {
# try to serve file directly, fallback to index.php
try_files $uri /index.php$is_args$args;
}
location ~ ^/index.php(/|$) {
#fastcgi_pass unix:/var/run/php7.2-fpm.sock;
fastcgi_pass php:9000;
fastcgi_split_path_info ^(.+.php)(/.*)$;
include fastcgi_params;
fastcgi_param SCRIPT_FILENAME $realpath_root$fastcgi_script_name;
fastcgi_param DOCUMENT_ROOT $realpath_root;
fastcgi_buffer_size 128k;
fastcgi_buffers 4 256k;
fastcgi_busy_buffers_size 256k;
internal;
}
location ~ .php$ {
return 404;
}
error_log /var/log/nginx/project_error.log;
access_log /var/log/nginx/project_access.log;
}
# HTTP redirect
server {
listen 80;
listen [::]:80;
server_name *.stomup.ru stomup.ru;
location / {
return 301 https://stomup.ru$request_uri;
}
}
O le mea moni, a maeʻa nei togafiti, matou te alu i le lisi ma Docker-compose, tusi docker-compose up -d. Ma matou siaki le faʻatinoga o SSL. E tatau ona alu ese mea uma.
O le mea autu ia aua neʻi galo o le Let'sEnctypt tusi faamaonia e tuʻuina atu mo le 90 aso ma e tatau ona e faʻafouina e ala i le poloaiga. sudo certbot renew, ona toe amata lea o le poloketi i le poloaiga docker-compose restart
O le isi filifiliga o le fa'aopoopoina lea o le fa'asologa i le crontab.
I loʻu manatu o le auala pito sili lea ona faigofie e faʻafesoʻotaʻi ai le SSL i le Docker Web-app.
PS Faamolemole ia manatua o tusitusiga uma o loʻo tuʻuina atu i totonu o le tusitusiga e leʻo maeʻa, o le poloketi ua i ai nei i le tulaga loloto Dev, o lea ou te fia fai atu ia te oe e aua le faitioina le configs - o le a suia i le tele o taimi.
puna: www.habr.com